Using Scapy to analyze PCAP messages

Demand:

1. Read the PCAP message captured by Wireshark

2. Filter out specific messages

3, analysis of the interval between the specific message is consistent with the law

Key function or variable:

Rdpcap ()

Filter (): Using a lambda function

P.time

LS () can be used to check the text of the supported fields, because the link layer and the IP layer with the field is repeated, you may use P[IP].SRC to represent the IP source address, type is a string.

P.load represents the original data area, and the type is a string.

Using Scapy to analyze PCAP messages